Is your API description public, and does it match your API?

This check reads a public machine-readable API description, such as an OpenAPI document, and notes which operations it says need sign-in. Publishing one can be deliberate, and it is also a map of your API.

What does this check look at?

It looks at whether a machine-readable API description, such as an OpenAPI document, is public, and which operations it says need sign-in. Deep then uses the description to test some read operations one at a time, and reports any that answer without sign-in separately. Tools meant for developers, like a public list of every API action or a query explorer, left on in the live site, are one of the things Lockpick's guide warns about.

Only a Deep scan runs it, after you prove you own the site.

What does a result mean?

What a description says about permissions does not prove what the running API enforces. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

How serious is a finding?

This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts high, because a response from your site shows the thing itself. The report lists what to fix by how directly someone could use it, not by the severity label.

Which standards does it relate to?

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

Fix it with your AI

Keep it public on purpose or move it behind sign-in, and either way test the API itself.

My API description document (OpenAPI or Swagger) is publicly reachable. Tell me whether anything in my app needs it to be public. If not, serve it only to signed-in staff or remove it from the production build. Either way, list every operation it describes and check in my code that each one enforces authentication and checks the caller owns the data, then add a test per route that a request with no session is refused.

How to check

Say Atlas, our example app at atlas.example, serves its OpenAPI document to anyone. A Deep scan parses it, notes three operations with no declared sign-in and tests the safe ones once each.

Deep scans come with the Deep plan, and pricing shows what it includes. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.